Select Custom Entities

Use Custom Entities when predefined identifiers don’t fully match your data, or when you need to detect organization-specific patterns. There are two kinds of Custom Entities: a Custom Data Identifier and a Custom Dictionary.

Custom Data Identifier

A Custom Data Identifier is a single detection rule built from a keyword, a regular expression, or a reference to a predefined identifier.

Custom Dictionary

A Custom Dictionary is a CSV file of keywords, phrases, or regular expressions, uploaded and reused as a single entity.

Selecting Custom Entities in a Rule

1. In the Entities page of the New DLP Rule workflow, expand Custom Entities in the Categories column, then click Data Identifier or Dictionary.
2. The Entities column lists custom identifiers or dictionaries you’ve already created. You can also click New in the column header to create one inline.
3. Click Next when finished.

Creating a Custom Data Identifier

1. On the Entities tab, click New Entity. The Create Entity dialog defaults to the Data Identifier option.
2. Name the identifier, optionally add a description, and choose whether matching is case-sensitive.
3. Define what it matches, using one of the following:

• A reference to a predefined identifier, such as {{Full Names (US)}}
• A keyword, such as Name
• A regular expression, such as [0-9]{5,10}

Use Validate Regex to check syntax before saving.

4. Assign a Data Type, either existing or new.
5. Assign a Sensitivity Level.
6. Optionally, configure Advanced Options to narrow matches.

Creating a Custom Dictionary

1. On the Entities tab, click New Entity.
2. Select Dictionary, then choose Keyword Dictionary or RegEx Dictionary.
3. Name the dictionary and choose whether it’s case-sensitive.
4. Click Select File and upload a CSV file. Note the following:

• Include one keyword, phrase, or regular expression per line.
• A single dictionary file holds either keywords and phrases, or regular expressions, not both.
• RegEx dictionaries are capped at 25 entries.

5. Optionally, configure Advanced Options.

Weighted Keyword Dictionaries

Keyword dictionaries support per-entry weights, which drive the DLP violation score.

• Format each line as [keyword],[weight]. Weight is optional and ranges from -100 to 100.
• If you don’t specify a weight, Netskope applies a default weight of 1.
• Positive weights increase the violation score; negative weights decrease it.
• Weights aren’t supported for regular expressions.
• The violation score is the sum of weights across all rule matches, and this score determines whether a rule fires on a violation.

Example: AWS access key dictionary

access key ID, 50
AWS, 10
AWS access key, 100
AWSAccessKeyId, 100
access keys
access, -20
Public Cloud, -100

Paired with a rule C0 NEAR D0, where C0 is a custom regex identifier \b[A-Z0-9]{20}\b and D0 is the dictionary above:

• Content containing only “Generate the access key” produces a rule count of 0, since no key-shaped match appears nearby.
• Content containing “Enter the AWS access key ID AKIAIVLZMKR5WZSQO5ZA” produces a rule count of 1, contributing a violation score of 100.

Data Type and Sensitivity Level

Every entity, predefined or custom, carries two classification attributes.

Advanced Options

Advanced Options narrow down what an entity matches when used in a rule.

Filter availability depends on the predefined entity you select:

• If no filters are defined, both Use Filters and Use Validator for Regex are grayed out.
• If one filter is defined, Use Validator for Regex is grayed out, and the entity’s default validator applies automatically.
• If both filters are defined, Use Filters and both filter checkboxes are pre-checked, and Use Validator for Regex is grayed out.

Netskope also applies text normalization during extraction, covering fonts, colors, line folding, and spacing, to improve detection accuracy. This incidentally helps counter text-based steganography.